Cryptographic Read Access Tokens for Encrypted Cloud Search
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises and sensitive sectors are reluctant to use cloud storage services due to the need for plaintext access for search functionalities, compromising data privacy, even with encryption, as access patterns can reveal significant information about the data.
Innovation Solution
A method for sharing read and write access to encrypted documents in a distributed system using cryptographic tokens, allowing users to authorize access without exposing keys to the cloud provider, using shared read/write access commands and tokens stored in user sets, enabling secure search and edit operations without decrypting data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If plaintext access is provided for search functionality, then search capability is improved, but data privacy is compromised
Solution Approach 1:
The patent introduces cryptographic tokens as intermediaries between the cloud storage provider and user data. These tokens enable search functionality without requiring the provider to access plaintext data, thus maintaining data privacy while preserving search capability. The tokens act as mediators that allow controlled access to encrypted data.
Solution Approach 2:
The patent segments access control by providing different types of tokens (read tokens, write tokens, administrative tokens) with specific permissions. This segmentation allows the system to provide search capability through read tokens while maintaining data encryption, resolving the contradiction between ease of operation and data privacy.
2Loss of information
If encryption is applied to stored data, then data privacy is improved, but search functionality deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-computing cryptographic tokens (such as trapdoor functions or searchable encryption structures) during data upload. This preliminary cryptographic processing enables the encrypted data to be searched later without decryption, thus maintaining data privacy while restoring search functionality.
Solution Approach 2:
Cryptographic tokens serve as intermediaries that bridge encrypted data and search functionality. The tokens contain encoded information that allows the cloud provider to perform searches on encrypted data without accessing the plaintext, thus resolving the contradiction between encryption and search capability.
3Extent of automation
If access patterns are monitored for functionality, then system control is improved, but information leakage increases
Solution Approach 1:
The patent uses cryptographic tokens as intermediaries that mask the true nature of data access patterns. The tokens allow the system to control and monitor access functionality while preventing information leakage about the actual data being accessed, thus resolving the contradiction between system control and information privacy.
Data Source
Figure 1
Figure 2A~2B
Figure 3A
AI summary
A method for sharing read access to a document (200) includes receiving a shared read access command (250) from a sharor (10a) sharing read access to a sharee for the document stored on memory hardware (150), and receiving a shared read access request (260) from the sharee (10b). The shared read access command includes an encrypted value (256) and a first cryptographic share value (252) based on a write key (204), a read key (202), a document identifier, and a sharee identifier. The method also includes multiplying the first and second cryptographic share values to determine a cryptographic read access value (224). The cryptographic read access value authorizes read access to the sharee for the document. The method also includes storing a read access token (222) for the sharee including the cryptographic read access value and the encrypted value in a user read set (220) of the memory hardware.